Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Prevent Installation of software


30 Jun 2010   #1
xarden

Windows 7 Enterprise
 
 
Prevent Installation of software

Hi all.

How would I go about preventing all students from installing software in classrooms?

There are some limitations as to what we can do.
..It needs to be done, preferably if possible, by group policy. We are running a 2003DC. (if a 2008dc is required, excellent. The more excuses to get one of these, the better)

..It also needs to be enforced regardless of if the PC or notebook or netbook is on or off the network. A local GPO might be possible if domain GPO isnt.

..There are only two local accounts, both generic administrator accounts for the Tech Staff. They will need access to install programs.
There is to be no other local accounts or guest accounts. At all.

..Deep Freeze is installed. It does not prevent installation, but it does remove any local changes on reboot. Some labs do not reboot or shut down.

..No other 3rd party tools to be used. Only genuine Microsoft products.
..We are not and will not be using SCCM, MDT, WDS.

I hope I've provided enough info.

I've also just tested the 'Disable Windows Installer' GPO, it doesnt work with software that doesnt use Windows Installer.
'Remove add/remove programs from Control Panel' is also enable. This also doesnt work, as most programs have their own Installers/uninstallers.

Cheers,


My System SpecsSystem Spec
30 Jun 2010   #2
WindowsStar

Windows 7 Enterprise (x64); Windows Server 2008 R2 (x64)
 
 

All machines are on Windows 7 Enterprise (x64)?
My System SpecsSystem Spec
01 Jul 2010   #3
gregrocker
Microsoft MVP

 

Why are students being allowed to operate as Adminstrators? That is a glaring deficiency in the setup.

They should use a regular User account (named Student or such) so Administrator account only needs to then be passworded to restrict them from installing anything.

Quote:
Why use a standard user account instead of an administrator account?

The standard account can help protect your computer by preventing users from making changes that affect everyone who uses the computer, such as deleting files that are required for the computer to work. We recommend creating a standard account for each user.
When you are logged on to Windows with a standard account, you can do almost anything that you can do with an administrator account, but if you want to do something that affects other users of the computer, such as installing software or changing security settings, Windows might ask you to provide a password for an administrator account.
My System SpecsSystem Spec
01 Jul 2010   #4
Bill2

Windows 7 x64 pro/ Windows 7 x86 Pro/ XP SP3 x86
 
 

1) If you are on Enterprise, Applocker should do the trick for you. Here is a good overview with multiple links.

AppLocker Documentation for Windows 7 and Windows Server 2008 R2

2) If you are using consumer versions of win7 (higher than home premium), you can use the Group policy to impose various restrictions on installing and running software but those will apply on "Standard" users, not Admins. As Greg said, its a bad idea to have students logging in as admins. This article explains things much better than I do, so take a look.

How to restrict users from installing programs in Windows 7 | The Windows Club
My System SpecsSystem Spec
01 Jul 2010   #5
WindowsStar

Windows 7 Enterprise (x64); Windows Server 2008 R2 (x64)
 
 

Thanks gregrocker and Bill2.
My System SpecsSystem Spec
01 Jul 2010   #6
xarden

Windows 7 Enterprise
 
 

Thanks Bill2, I'll look into those.
@WindowsStar: Yes, its Win7 x64 Enterprise.
My System SpecsSystem Spec
Reply

 Prevent Installation of software




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:13 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App